��m>&��d�-�qG��Ä��#����D��П����ld�{�!�bM�-ٞ�� #�2rC�*k������@�����;^{�'Z-(.7��AJ�r�]��{W6�KI�|p��TN=/����!�Y�L� �Y���n�d��une��3Q�Qo{U�n՜{?�;&��\��ڒ�$C�S048lv���i!X���5��--*��K�o���]|���[� r*ѕ۲Z"�>-E�MA��H�ã���c� y�-��|�Ɲ� �¾~����9��OG3>�:V��y���\N[��Ò����q�6��$�f-m��TϹ���SG;ڬ5 �)��IV�=��Z��>·\�_e��t�7mɓ%�!��x��:���PÙ��M;X�3�*ha ����@ץ"�6==�*��Qq���b�^��������5�f�J_����������S"�l^j�4��v���~+�z�ϊ=�؆��5 ���N�@��Oݲ�e�t��AXa�F����mX����D��*!%�ll�*X�A���t5�lE1J�+˪���nͥ�E��4���,jL������tG}�^JD? �U��g�`�6��tD��љ�����U����RWJa�� �"���� fv���o�F!�S%Q�_���{9X%[� 8ƕ�o�3n��&�x�� Ht�gB�������P+��Z:hi���-���[�1N�[���y9�^�����;��Cˏ�@�~ܼ���?&߅9I ��#�����c�������'�'�h1or+%�aBq�}�������}r�B�8��&QI�d�$7�O��ٙ��9@3V�o}˨0�����e�q@���X���Gů-��<1���<�J����$���vj8�ti�M@�>�i�0֏e��krE���1������R����^�*o]�y��ER�ng��r�3e�@7u�'��� �&:)����2P�h�$������M���?_G B��]i-)�dc{�ֿU�7�8�Q�aTVVX�L9>��z��I���b>5Z�F"� �eov�#;����S�$t�e�� wz�L4k]���<�GW��M�īVzDg��͘=�X?̌�,�NǑ,���X��w�<��t�����-N͆�O{Z��� ��t����l'9��7�S�V��^��z@ �+�0�wL��V,�@���!�8c��C�,�@�{s�g�&�Ҏ�u2aE��*C/8��7��KS�yNs �U�J73���=L�/�_�y<\�8TH� JO���5��Aν5!�����p�c��(�����H.�QR��}bs�$�=K� �=;�ڕ��6� �[G���O��lϽ�o�b�O�����~GqtY��ʞٷ��uT1D������B"�`Vsz�oH����o�b�Ē�}�W}��.6�l5���/��p�$-N�o�0��/oh����A��{��`��2��8�m��vu�t�c'���:��3�D��A �햽�4����Qb����1���� ��^D���H6�+�B��_B�f���`�c�$^E�خ��2֪I�`���eNJ���s�A�4�� AV�uk��~"<��7�Gy��dj&�K �n��p��i�lޜd´O���>�{�g(jN{���_�%<mܚ]ƃ]�Y$o�w�,aO�#�id�0w���V��U�1�t213>BX|�W�S���^0*���8���D����_;~lU;9N��Ź��S��0O� ��4L�ؾT|��`��:Uz/y�q���a��h�֕z���%t�rx&&r+,���L҄�M���ehuR���+w�����O��t�R��ͩ��GD��K^��r�x2��Jg�Y� 2Ԡ/��ivRGg]�WƋ|�惘Q��S��+=ǣ(H��C�K��bVd'�L�`�C���6����Z���`p�o�$�CQ�u�m�����ϼ�zz+�7/f�kd�<�ф4v�.�9�p�b�m]8�(f�h}Py��Z�\ңz����l��֮v�k�[�^��Fi5�n�@3��t����-M�M�./^����z�53�z����M��U��|����l��tAd�n`�9>������Yy�"�9����Qy`�)Y�����-��i�n��)�F���km�'G��*���˪����9"�l��N�,Rڨm�v�(]� k�qVB,�N�A���մ�fϏ/ۭ��b�xr�ض5���؟v�8a7���V#��R����f� !���et �,А���v�� �����j�7��L�G&��hNJA�|}9Rt;;B3��dtD6�L�{����wF�r��� �[�w�d4{�2�h�$y_i9��q�� �t��ᢗ�<qD��O��X^lWt����No@���mGZJ)�|K'�i�8Y��{^ɿ����:"D}�қ�o��\C��M����Q���~�Ť[�����`W(NH�~B��n�ʾF����e�T�J-�����Cn 5��ˠ�5�*���Z�)ȧ� ���p�,`��' �0�oc��HG�KLjʧ���+�R���재��l���U���v��p�#�3v�(��?�*��0��W��{����zo ���dÞ�����y{���5����`�"��ñd#�k � >X@��y���2 �\A�ש'`��[¥��s��� 3�q9���X�h���k���s�C�[�2����a]}�:NN/� �-*=�5�LN2�%n���c��w��q���AZh>�%��na ˚�lr���U�]����A����v��9�C�-Jp/�����ط�X-�?�a&۔��.K��Ɗ��D#�2O>�� ���(�2�Nl�2�z�b�k�WO�����_���gB������0G6�6s���`���;뙭P"�?^����L��f[���x�'grJF�$5��#A"'V����/s�.=h䣅copדA�t�XI�ƚ�S�7u�fj5���a�5���B���y�|�T�6;�E�B��@/Κ��ek������&P��b^1�[_�Y���tH�y�2��_aW��+`&g( ��I+�-'%�}�v8�vS
Behavioral task
behavioral1
Sample
75e7d70f0f89a581deeb44e9acf7c9ab_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
75e7d70f0f89a581deeb44e9acf7c9ab_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
75e7d70f0f89a581deeb44e9acf7c9ab_JaffaCakes118
-
Size
735KB
-
MD5
75e7d70f0f89a581deeb44e9acf7c9ab
-
SHA1
c04fc30e5fce2554d75c0e4fe1da2ea3ed2affdd
-
SHA256
39f7b942623157bd451490d65dfff32a734620fad364270a0fe91c8a32bcd275
-
SHA512
f9facf2108135942da98db11558b7ea3c113ad21e14352b4e7e4148341095fddb32eaadf3b5ef1be94f983a3503ff2e361e512a531c4fc097118d1dd24f6e6da
-
SSDEEP
12288:Q/YAMTWMOavBjzgKczdNYaOhb31ih9FlaL5TFfXCXCfD/Ju58hwJtrWWgTd/t/hT:Q/Z7PkpchNMpy9+FfCX0/UwIWxX/j4H0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75e7d70f0f89a581deeb44e9acf7c9ab_JaffaCakes118
Files
-
75e7d70f0f89a581deeb44e9acf7c9ab_JaffaCakes118.exe windows:4 windows x86 arch:x86
de4554d0aae3d579454064a4074e897d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
WriteProcessMemory
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
Exports
Exports
Sections
.nsp0 Size: - Virtual size: 1000KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 677KB - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ